code-review

🛠️ OpenClaw Skills — Software Quality Toolkit

Four skills that make AI agents build better software. Built for OpenClaw, the open-source AI agent platform.

Inspired by real production experience deploying AI agents + ideas from gstack. Zero dependencies, pure methodology.

Skills

How They Work Together

You have a plan
    │
    ▼
┌──────────┐    Autonomous? ──▶ Kapilot (orchestrates everything)
│  Build    │         │
│  Code     │         │    Kapilot runs these automatically:
└────┬─────┘         │    ├── code-review (R1)
     │                │    ├── security-audit (R2)
     ▼                │    └── debugger (when tests fail)
┌──────────┐         │
│  Review   │◀────────┘
│  Code     │──▶ code-review
└────┬─────┘
     │
     ▼
┌──────────┐
│ Security  │──▶ security-audit
│  Check    │
└────┬─────┘
     │
     ▼
┌──────────┐
│  Bug?     │──▶ debugger
│  Debug    │
└────┬─────┘
     │
     ▼
   Ship it 🚀

Individually: Each skill works standalone. Ask for a review, debug a bug, or run a security audit anytime.

Together via Kapilot: The autonomous pipeline uses all three as quality gates. Code review (R1) → Security scan (R2) → Debug if broken → Commit → Next phase.

Installation

OpenClaw (recommended)

Copy the skill folders to your OpenClaw workspace:

# Clone this repo
git clone https://github.com/kapitecsoluciones/openclaw-skills.git

# Copy skills to your workspace
cp -r openclaw-skills/code-review ~/.openclaw/workspace/skills/
cp -r openclaw-skills/debugger ~/.openclaw/workspace/skills/
cp -r openclaw-skills/security-audit ~/.openclaw/workspace/skills/
cp -r openclaw-skills/kapilot ~/.openclaw/workspace/skills/

OpenClaw auto-discovers skills in ~/.openclaw/workspace/skills/. No config needed.

Claude Code

These work with any agent that reads SKILL.md files. For Claude Code, drop them in your project's .claude/skills/ directory.

Other Agents

Each skill is a self-contained Markdown file. Any agent that can read instructions from a file can use them. No binaries, no config files, no lock-in.

Quick Start

Code Review

Just ask your agent to review before deploying:

"Review the code before I deploy"

It will:

1. Identify changed files (via git diff or specified files)
2. Run automated checks (syntax, secrets, security patterns)
3. Analyze each file for P0 (blocks deploy) through P3 (nice to have) issues
4. Auto-fix obvious problems (P0 + simple P1)
5. Give a verdict: ✅ SHIP IT / ⚠️ FIX THEN SHIP / 🛑 DO NOT SHIP

Debugger

When something breaks:

"Debug why login returns 500"

It will:

1. Investigate — Reproduce, read logs, check timeline
2. Analyze — Narrow scope, read code, check assumptions
3. Hypothesize — State root cause, prove it
4. Implement — Minimal fix, fix siblings, verify

Iron Law: No fix without confirmed root cause. If it can't explain the bug in one sentence, it goes back to investigating.

Security Audit

Two modes:

"Quick security check" → 5 min, high-confidence findings only

"Deep security audit" → 20 min, OWASP Top 10 + STRIDE + dependencies

Checks: hardcoded secrets (including git history), SQL injection, XSS, auth bypass, CORS misconfiguration, debug mode in production, default credentials, outdated dependencies.

Kapilot (Autonomous Pipeline)

Give it a plan file and let it run:

"Activate kapilot with PLAN.md"

It sets up a cron job that:

1. Reads the current phase from the plan
2. Implements it
3. Reviews (code-review + security-audit)
4. Checks scope (did it build what the plan says?)
5. Verifies (build + tests pass)
6. Commits with detailed message
7. Advances to next phase
8. Notifies you

Runs every 15-30 minutes. You wake up to commits.

Stop conditions: All phases done, critical security issue, build fails 3x, or you say stop.

Design Principles

1. Methodology over code. These skills are instructions, not programs. They teach the agent how to think about quality, not just what commands to run.

2. Composable. Each skill works alone. Together they're a pipeline. Mix and match.

3. No dependencies. Pure Markdown + standard CLI tools (grep, git, curl). No npm packages, no binaries, no config files.

4. Fail loud. When something's wrong, stop and tell the human. Don't bury errors in logs.

5. Evidence-based. Every finding has a file:line reference. Every bug fix has a root cause. Every security issue has a concrete grep result.

Contributing

PRs welcome. Keep skills as pure Markdown methodology — no binaries, no build steps, no telemetry.

License

MIT — Use however you want.

---

Built by Kapitec Soluciones 🤙